Threat briefs

The MCP PHP SDK's HTTP transport fails to bound the in-memory buffer used for Server-Sent-Events, allowing a malicious server to trigger a denial-of-service via memory exhaustion.

A privilege escalation vulnerability in the XWiki Platform Live Data Live Table component allows users with page edit rights to acquire script rights through manipulated REST API requests.

An authenticated administrator can exploit a server-side template injection (SSTI) vulnerability in GeoServer's FreeMarker engine to execute arbitrary OS commands and perform unauthorized file operations.

An authenticated attacker can exploit an information disclosure and IDOR vulnerability (CVE-2026-55694) in Snipe-IT to leak and download confidential, restricted EULA documents belonging to other users.

A misconfigured .htaccess file in Grav allows unauthenticated remote attackers to bypass access restrictions and download sensitive configuration and source files by utilizing uppercase file extensions on case-insensitive filesystems.

The @logto/tunnel package (v0.3.8 and earlier) is vulnerable to a path traversal attack allowing unauthenticated, remote read access to local files via improper URL sanitization.

Adversaries frequently utilize unconventional Windows directory paths to execute malicious payloads while evading traditional file-based security controls and detection mechanisms.

The Braodo stealer malware captures victim desktop screenshots and stages them in temporary directories, facilitating subsequent data exfiltration.

Adversaries and information-stealing malware, including RedLine and StealC, query Windows registry keys in 'Microsoft\Windows\CurrentVersion\Uninstall\' to perform software enumeration for target selection.

This brief describes the detection of remote thread creation (Sysmon Event ID 8) in sensitive Windows processes used by malware such as Qakbot and Warzone RAT to perform process injection.

Adversaries use the Windows 'rmdir' utility with recursive and quiet flags to systematically purge forensic artifacts, malware components, and temporary directories to hinder incident response efforts.

Detection of uncommon processes accessing sensitive local Azure configuration and credential files, a common technique utilized by infostealers like Vidar Stealer to harvest cloud tokens.

Detection of unauthorized processes enabling the 'SeDebugPrivilege' token, a technique frequently used by malware to perform credential dumping and code injection by bypassing Windows object access security.

This detection identifies non-Firefox processes attempting to access sensitive user data stored within the Firefox profile directory, a common technique utilized by information-stealing malware to harvest credentials and browser history.

Adversaries frequently utilize temporary Windows directories as staging areas to drop and execute malicious payloads, bypass detection, and maintain persistence.

MLflow Tracking Server versions prior to 3.15.0 are vulnerable to an unauthenticated full-read SSRF attack because the webhook delivery mechanism follows unvalidated HTTP redirects, allowing attackers to exfiltrate internal data or interact with local services.

Hospital Information System 1.0 is vulnerable to unauthenticated remote SQL injection via the 'email' parameter in the User::login function, allowing for unauthorized database access.

A vulnerability in the IBM PowerVM Hypervisor service processor mailbox interface allows an authenticated attacker to execute arbitrary code within the host firmware runtime.

An authenticated SQL injection vulnerability in the ISPConfig Remote API allows low-privilege users to execute arbitrary queries, leading to unauthorized data exfiltration and cross-tenant record manipulation.

ICEcoder version 8.1 contains a critical vulnerability allowing unauthenticated remote code execution via a crafted HTTP POST request to the terminal endpoint that chains authentication and CSRF bypasses.

A critical RBAC vulnerability in the submariner-operator component allows a compromised Kubernetes cluster to overwrite endpoint configurations, enabling inter-cluster traffic interception.

The TrueBooker plugin for WordPress up to version 1.2.6 is vulnerable to an unauthenticated account takeover via a flawed AJAX handler that allows attackers to modify user email addresses.

IBM Power Systems Firmware contains a stack-based buffer overflow in the ASMI web interface, allowing an unauthenticated attacker to achieve arbitrary code execution on the Flexible Service Processor.

A stack-based buffer overflow in the firmware boot image validation process of specific IBM Power Firmware versions allows attackers with service processor access to execute arbitrary code on the host system.

FFmpeg versions prior to commit acf5d7c contain a heap-based buffer overflow in the hvcC box writer that can be triggered during HEVC file muxing, potentially leading to arbitrary code execution.

A vulnerability in the search-v2-operator allows a privileged user to manipulate Custom Resource fields, leading to secret exfiltration and container image replacement.

Halo versions up to 2.25.4 are vulnerable to RCE through insecure plugin installation and migration restoration processes, which can be chained with CSRF to allow unauthenticated attackers to compromise an instance if an administrator visits a malicious page.

Keycloak suffers from a vulnerability in its legacy client-initiated account-linking endpoint where predictable hashes allow attackers to forge linking URLs, facilitating unauthorized account takeover.

A local privilege escalation vulnerability in Citrix Workspace App for macOS allows a local attacker to elevate their system permissions.

A vulnerability in OpenBao allows remote, unauthenticated attackers to bypass security controls, potentially leading to unauthorized access to sensitive secrets and data.